2

I've just finished setting up supervisor to run my gunicorn instances and I was wondering if there is a default way to let a regular user run supervisorctl to start/stop the websites. I was thinking of adding some sudo config that would enable this user to run it but then I think it might open some loophole through which an intruder could run stuff as root. I know I can set user=someuser on the [supervisord] config section, but then I'd have to give permission to that user for files all over the filesystem, for logs, socket creation, etc. That would be a problem because the standard ubuntu package deploy assumes supervisor will be run as root.

So which one is better, or is there another alternative?

Improve this question

2 Answers 2

Reset to default
0

sudo is really the better alternative here. If you are afraid that they can pass arguments to supervisorctl other than start/stop, maybe create two small binaries (not scripts!) that do nothing other than call supervisorctl start/stop (and not using system(3) but exec(3)) and only enable calling those two specific binaries for the user.

Improve this answer
2
  • Surely a script will do. Just make sure that the user(s) in question can't write to the script ? Commented Jul 4, 2011 at 20:04
  • The problem with scripts is that they are insecure. Maybe not for such a simple script, but in time it will be modified. Because of this, I discourage their use. Commented Jul 5, 2011 at 1:28
0

Deploy your websites in a buildout, build supervisor inside of it, and then bin/supervisorctl start/stop will be the user id, all the config will be in the buildout, and it will not require root.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.